REMARKS 



Independent claims 1 and 8 have been rejected under 35 U.S.C. 102(e) as being 
anticipated by Suuronen et ah {Suuronen). The dependent claims have been rejected under 
Section 103(a) over Surronen, Hoene in view of Ontiveros, Balissat and Wells. 

The independent claims have been amended to recite steps of creating an anti-virus agent 
(or "curing" agent). The steps include parsing the virus into three modules, analyzing one of the 
modules to determine the method of infection, modifying the module to infect client devices 
already infected by the virus, incorporating the anti- virus into another module that acts to prevent 
further infection by the virus, and forming an anti-computer virus agent by combining the three 
modules. These steps are not disclosed, shown, or suggested, in any of the cited references taken 
alone or in combination. 

The claims have also been amended to clarify the definition of the term "virus outbreak" 
which includes correlating a specific number of virus attack reports and determining that an 
outbreak has occurred when the number of occurrences of a specific virus has surpassed a 
threshold number. The claims now also recite the new step of a controller signaling a virus 
monitor to switch to "inline mode" where all data packets are checked for the virus and related 
viruses without copying of the data packets. This mode is described in the specification at, for 
example, pages 25 and 26. These steps are not disclosed, shown, or suggested, in any of the 
cited references taken alone or in combination. 

With respect to claims 4 and 11, the term "substantially" is defined in a particular context 
as disclosed on page 25 (first paragraph) of the specification. There is typically a small number 
of data packets that are of a type that is not vulnerable to virus infection. However, most data 
packet types are vulnerable to virus attacks. Thus, the term "substantially" is intended to convey 
that not each and every data packet is copied in the first mode (inline mode), but that a 
substantial number of them are. Applicant is willing to further clarify this term either in the 
Remarks or by amendment is deemed necessary by the Examiner. 

Applicant believes that all pending claims as herein amended are now allowable and 
respectfully requests a Notice of Allowance from the Examiner. Should the Examiner believe 
that a telephone conference would expedite the prosecution of this application or that further 
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clarification is needed with regard to the amendments, Applicant's representative can be reached 
at the telephone number below. 
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